Ireland's Data Protection Commission has fined Google EUR 403 million over GDPR breaches linked to its processing of location data.
The decision imposes administrative fines totalling EUR 403 million and orders Google to bring its processing into compliance with the GDPR within six months. The DPC opened the inquiry in February 2020 in its role as Lead Supervisory Authority for Google. It followed complaints from several European consumer rights organisations, including BEUC, about how Google processed location data in certain services and products. The final decision comes more than six years after the inquiry began.
The investigation examined three features: Web & App Activity, Location History, and Location Accuracy. It covered the period from 25 May 2018, when the GDPR began to apply, to 4 February 2020.
Findings in four areas
The decision was taken by the DPC's three Commissioners for Data Protection. It found that Google infringed the GDPR in four respects.
First, the regulator concluded that Google's processing of location data in Web & App Activity and Location History did not meet the GDPR's requirements of lawfulness and fairness. Second, Google failed to meet its accountability obligations because it could not demonstrate that its processing in Location Accuracy complied with the principle of lawfulness, fairness, and transparency. Third, Google breached its transparency obligations across all three features. Finally, the DPC found infringements in how Google retained location data in Web & App Activity and Location History.
The DPC said it had worked with peer supervisory authorities on the case. It will publish the full decision at a later date.
The regulator's reasoning
Deputy Commissioner Graham Doyle explained that location data is personal data processed through location tracking. It includes any data collected or processed by Google from which an individual's location can be inferred, either on its own or combined with other information. It was also noted that such data can make online services more useful. It can also reveal a significant amount about an individual, including information that is inherently private.
The DPC pointed to the GDPR's requirement that personal data across the EEA be processed lawfully, fairly, and transparently. In the regulator's assessment, Google's failures meant users may not have known their location was being used to infer their interests or to influence them with advertising. As a result, users could lose control over their personal data. The DPC added that keeping location data for longer than necessary made the loss of control worse.
How the three features work
Web & App Activity is an account setting available only to Google Account holders. When it is enabled, Google processes information about user activity across its services, including sites and apps. This can include browsing history, search history, and location data.
Location History is an opt-in service that tracks users' location while they carry compatible mobile devices. It infers place visits, activities, and routes between those places, and shows them on a private map in Google Maps through a feature called Timeline. The service records where users go with signed-in devices, even when they are not using a Google service.
Location Accuracy is an Android OS feature that lets a device determine its location more precisely than it could using GPS inputs alone. It is available to Android users whether or not they hold a Google Account.
